CVE-2025-55126 Overview
CVE-2025-55126 is a stored cross-site scripting (XSS) vulnerability in Aquaplatform Revive Adserver. The flaw resides in the navigation box rendered at the top of advertiser-related pages. Campaign names serve as the injection vector, allowing an attacker to persist malicious script payloads that execute in the browser of any user who visits an affected page.
The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation. The vulnerability was disclosed through HackerOne by community researcher Dang Hung Vi (vidang04).
Critical Impact
Authenticated attackers can store JavaScript in campaign names and execute arbitrary script in the sessions of other advertiser or administrator users viewing the navigation box.
Affected Products
- Aquaplatform Revive Adserver (all versions prior to the fixed release)
- Deployments using the advertiser and campaign management UI
- Multi-tenant Revive Adserver instances where campaigns are shared across roles
Discovery Timeline
- Vulnerability reported by Dang Hung Vi (vidang04) via HackerOne
- 2025-11-20 - CVE-2025-55126 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55126
Vulnerability Analysis
Revive Adserver renders a navigation box at the top of advertiser-related pages that lists associated campaigns. Campaign name values submitted through the admin interface are stored in the database and later reflected into HTML without adequate output encoding.
An authenticated user with permissions to create or edit campaigns can supply a name containing HTML or JavaScript. When any user subsequently loads a page that renders the navigation box, the browser parses the payload as active content. This produces a persistent XSS condition scoped to the advertiser workflow.
The attack requires no user interaction beyond navigating to a page that includes the vulnerable component. Impact includes session token theft, forced administrative actions through the authenticated UI, and pivoting to other advertiser accounts within the same tenant.
Root Cause
The root cause is missing or insufficient contextual output encoding when rendering user-supplied campaign name strings into the navigation box template. Input validation on the campaign name field does not strip or neutralize HTML control characters, and the template does not apply HTML entity encoding at the sink.
Attack Vector
Exploitation proceeds over the network against an authenticated Revive Adserver instance. An attacker with campaign management privileges stores a payload in the campaign name field. The payload persists in the database and is served to every user whose UI loads the advertiser navigation box, including higher-privileged operators.
See the HackerOne Security Report for the researcher's technical writeup.
Detection Methods for CVE-2025-55126
Indicators of Compromise
- Campaign name fields containing <script>, onerror=, onload=, or javascript: substrings in the Revive Adserver database
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading advertiser pages
- Audit log entries showing campaign creation or rename events followed by anomalous session activity
Detection Strategies
- Query the campaigns table for name values matching HTML tag patterns or JavaScript event handler keywords
- Deploy Content Security Policy (CSP) reporting to capture blocked inline script execution attempts in the admin UI
- Inspect web server access logs for POST requests to campaign create and edit endpoints with encoded angle brackets in the payload
Monitoring Recommendations
- Alert on new or modified campaigns whose name field contains angle brackets, quotes, or event handler tokens
- Correlate administrator session anomalies with recent visits to advertiser pages that render the navigation box
- Monitor for privilege changes or credential resets initiated from unexpected source IPs following advertiser page views
How to Mitigate CVE-2025-55126
Immediate Actions Required
- Upgrade Revive Adserver to the vendor-patched release referenced in the HackerOne report
- Audit existing campaign names for stored payloads and sanitize or remove offending entries
- Restrict campaign creation and edit permissions to trusted operators until patching is complete
Patch Information
Refer to the vendor's HackerOne disclosure at hackerone.com/reports/3411750 for the fixed version and remediation notes. Apply the update across all Revive Adserver instances, including staging environments that share campaign data.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts on advertiser and administrative pages
- Add a web application firewall rule to block campaign name submissions containing HTML tags or JavaScript event handlers
- Temporarily disable the advertiser navigation box component if the deployment permits template customization
# Example WAF rule pattern to block XSS payloads in campaign name fields
# ModSecurity example - adapt to your WAF syntax
SecRule ARGS:name "@rx (?i)(<script|onerror=|onload=|javascript:)" \
"id:1005512,phase:2,deny,status:403,\
msg:'Blocked potential XSS in Revive Adserver campaign name (CVE-2025-55126)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
